Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- -
- Download Here --> https://tinyurl.com/rhf4x3dp (Copy and Paste Link)
- Meta’s Laid-Back Approach to User Hacking
- Recently, I did the thing you are never supposed to do: I clicked on a weird Instagram link. Predictably, my account got hacked. The hackers changed the email and phone numbers associated with my account, changed my username, and started DMing everyone I know about weird crypto schemes and posting that I started a clothing line. Thanks to Slate’s contacts at Meta, I was able to email a real person at the company and get my account back. But for users who don’t have a personal connection to Meta, there is no reliable way to get a hacked Facebook or Instagram account back. These accounts may hold a lifetime’s worth of pictures of loved ones, or be the basis for an entire small business; when they get hacked, it can feel like losing an appendage. So why doesn’t Meta seem to care about the issue?
- On a recent episode of What Next: TBD, I spoke with Kirsten Grind, investigative reporter for the Wall Street Journal, about why Meta makes it so hard to get your hacked account back. Our conversation has been edited and condensed for clarity. Lizzie O’Leary: Facebook has almost 3 billion active users, Instagram roughly 2 billion, and all of those users like, love, or maybe even depend on their accounts. What options do users have if they lose access to their beloved accounts? Kirsten Grind: There’s really not much you can do. You would think there would be a customer service email, or a phone line, or at the very least a chat bot. There’s actually nothing. Facebook provides some guidance online for forms that you’re supposed to fill out to get your account back. I’ve heard that that often doesn’t solve the issue, and they just have not built out up into this point any customer service function at all.
- When I got hacked, I got a notification from Instagram saying, “The email associated with your account has been changed. If you did not do this, let us know.” But then I ended up in an endless loop of trying to change it and the hackers would just change it right back.
- I’ve heard very similar stories where the user goes through the process, sometimes repeatedly and nothing happens, and then when nothing happens and you still don’t have your account, there’s literally no one you can go to for help. What are some of the more creative ways you’ve heard of people getting their accounts back? Meta’s virtual reality division at one point had a customer service line, so some people were buying these expensive virtual reality headsets, literally just to get someone in customer service to restore their Instagram or Facebook account. I talked to people who literally spent $300 or $400 on a headset that’s just sitting in their house now just to get their Facebook account back.
- Some people have hired lawyers to send scary letters to various people at Meta, but even knowing who to email it to is kind of challenging. Some people have emailed like Mark Zuckerberg, and they just don’t get a response back. Another common one I’ve heard is finding random Meta employees in your area on LinkedIn and messaging them for help. When this happened to me, I kept thinking Meta must have teams of people whose job it is to help with this stuff. Do they?
- No, they don’t, and there’s a lot of reasons for that. One of the reasons is the expense: Think of having customer service for 3 billion people. The other reason is a cynical reason, which is Meta users are not their customers. We are not paying for this service, so why would they help us? Meta has said in the past that it could be a security issue if they have people on the phone talking to you—maybe they’re actually talking to a hacker? I’ve heard that explanation, too, but it’s unclear why they have no one yet.
- What did they say to you in your reporting process? They said that they’re now looking at building out some kind of customer service function, and they have acknowledged that it’s going to be hard and it’s going to take a while. When I recently reported that Meta employees were themselves, some of them, facilitating this hacking, they of course have said they do not stand for that. They’ve been firing these employees, investigating the issue. So they seem to be on it somewhat, but, man, there’s a lot of users having trouble.
- We reached out to Meta for comment. A company spokesperson told us that in 2021, Meta formed a team to improve customer support and started building a customer support platform. They said, “Our goal is to ensure the people and businesses who rely on Meta’s platforms every day can get support when they need it.” Do we have any way of knowing how many users are having trouble?
- I’ve never seen a number and I’ve looked for one, maybe not super hard, but I don’t think there’s been one publicly reported. When I was hacked, I made the mistake of tweeting about it, and it triggered this flood of people replying to me saying, “I run a service that can help you get your account back. DM me here, message me here.” Is there a weird little ecosystem of shady dealers who prey on people who’ve lost their accounts? 100 percent there is. There are these people claiming that they can get your account back, and I’ve talked to users who have literally paid thousands of dollars to these people. However, sometimes it seems to work. So this is the part where it seems like some of these people—and I’ve talked to people who have claimed this—have some kind of in with a Meta employee. So there legitimately does seem to be some people who have some kind of connection to help you get your account back, but then there’s definitely a lot of others that are just taking your money and months go by and nothing happens to your account.
- There is an internal channel at Meta that can help people get their accounts back. It’s known as “Oops.” Oops is a way for Meta employees and contractors to not only help get their accounts back but also their friends and family. It’s supposed to be for people you know, business partners, someone on Mark Zuckerberg’s team, or something like that, but it’s just so many people are having trouble with their accounts that the number of so-called tasks happening in this Oops channel has just risen over the years dramatically. The very existence of a channel like that both makes total sense and is a wildly inequitable system. Like, “Oh, you have to know someone whose cousin works at Facebook in order to get your name in front of a human.”
- It wasn’t initially founded that way because these problems with hackings seem to be more prevalent in recent years. And so I think it wasn’t set up that way, the Oops channel. It was truly supposed to be just an internal system for employees and not this sort of backdoor way for all users to try and get help. Who has access to it?
- Meta employees, but also contractors, which is very odd, like physical security guards that are stationed in Meta offices. As part of the process of working for a Meta location they’re onboarded to be able to use the system, and so that sort of opens the door for a lot more access than just employees.
- Perhaps it was inevitable given the amount of power involved that the Oops system would be abused too. You broke a story showing that Meta was investigating employees and contractors for basically selling their access to it. Can you tell us more about that story? What some employees allegedly were doing was actually aiding the hackers, so they would accept a bribe from a hacker to get access to a user’s account. So basically it was a way for someone on the outside to easily access Facebook user data, which is just terrible. This is obviously a huge problem that Meta is aware of and is investigating, because you can’t have your own employees and contractors improperly accessing user accounts.
- Do we know how many people had access to the Oops channel? Most employees and a lot of contractors, so thousands and thousands of people have access to file an Oops claim through that channel. What we reported in our most recent story was that Facebook was investigating more than two dozen employees and contractors for improperly accessing those accounts.
- And they have lawyers on it. They’ve been sending these really scary lawyer letters to current and former employees and other intermediaries who are facilitating this access of accounts, so they’re definitely aware of it. Someone could listen to this and say, “Get over yourself. It’s just your Instagram account, it’s just Facebook. This is not real life.” What would the people you’ve talked to, who have lost their accounts, say to that?
- First of all, there’s the category of people that have literally built small businesses around Instagram and Facebook. Their pages are set up to advertise themselves to the world, and they’ve spent years building up followers and all of this. To have that destroyed is just terrible. I personally am most affected by the people who have their life’s memories on Facebook and haven’t thought to save photos. These are often older people. I heard from someone whose parent had died, and all their memories were on Facebook. They could no longer access that account, and they couldn’t get anyone to help them.
- Popular in Technology
- This has been an issue they’ve been following for about a year now. They’ve been doing this big internal investigation, specifically into the issue of employees improperly accessing user accounts, and so they seem to be on it in that respect. Also, in regards to the Oops channel, they’ve definitely tightened up access, especially among contractors accessing that channel, but it’s hard to say exactly what they’re going to be doing and what’s going to happen going forward. In a way, it hurts users because tightening that one access is, again, the only way for a user to get help sometimes.
- In reporting these stories, has it made you think at all about how tech companies think about the users of their services?
- I think about that a lot. It’s actually why I get interested in stories like this because strangely sometimes users get overlooked when we cover tech companies. We’re so focused on like “how is Facebook moderating content?” or “how is Elon Musk changing Twitter?” You stop seeing stories about how the user is affected. And the funny thing is, none of these tech companies could exist without the user.
- Future Tense is a partnership of Slate, New America, and Arizona State University that examines emerging technologies, public policy, and society.
- 62 Compelling Hacking Statistics 2023: Data on Common Attacks, Impact & Prevention
- Individuals and businesses today are embracing the acceleration of digital capabilities. However, there comes with it the risk of falling victim to a cyber attack. With the rapid shift to digital platforms brought about by the COVID-19 pandemic, hacking incidents have only become prevalent. Thus, it’s important for consumers and organizations to be aware of the risks of their online activities.
- In this article, you will find a compilation of hacking statistics. These will help shed light on the various issues surrounding cybersecurity. Get to know some eye-opening data on these topics from email hacking statistics to password hacking statistics. These show that hacking is a very real threat that can happen to anyone. Moreover, social media hacking statistics will show how individuals and corporations can be targets. With awareness of the risks, one can adopt steps to prevent hacking incidents.
- Hacking Statistics Table of Contents
- General Hacking Statistics
- There has been a rise in internet crimes reported in the United States and the United Kingdom. Hacking statistics indicate various methods for malicious actors to carry out their intent. However, common methods involve the use of hacking into emails and social media accounts. Compromised passwords because of weak credentials and lost or stolen passwords likewise contribute to the problem.
- In the past five years, there were over 2.2 million complaints of internet crimes reported to the FBI’s Internet Crime Complaint Center. (FBI IC3, 2020)
- 70% of data breaches in 2020 occurred in on-premises assets while 24% occurred in cloud assets. (Verizon, 2020)
- 96% of data breaches in 2020 involved information technology. In contrast, only 4% involved operational technology. (Verizon, 2020)
- There were 55 new ransomware families/unique variants tracked in 2020. 21 of them or nearly 40% were observed to be stealing data from victims. (F-Secure, 2021)
- Companies in the UK experienced on average 157,000 cyberattacks during the first quarter of 2020. This translates to more than one attack per minute. Furthermore, the rate of attack was 30% higher compared to the first quarter of 2019. (Beaming, 2020)
- The FBI IC3 reported a spike of 400% in cybercrime reports during the pandemic. (The Hill, 2020)
- White hat hackers earned around $40 million in bounties in 2019. Six hackers surpassed $1 million in lifetime earnings in 2019. (HackerOne, 2020)
- Source: Federal Bureau of Investigation Internet Crime Complaint Center, 2020
- Email Hacking Statistics
- 46% of organizations got malware through email. In contrast, 22% of organizations got malware from other sources. (Verizon, 2020)
- 96% of social actions were delivered through email. On the other hand, 3% were delivered via a website while only 1% were delivered through phone or SMS. (Verizon, 2020)
- During the first half of 2020 51% of malware was delivered through emails. This slightly increased to 52% during the second half of 2020. (F-Secure, 2021)
- From July to August 2020, there was a 214% increase in COVID-themed spam. The top threat delivered through COVID-related spam is AgentTesla at 27%. AgentTesla is a form of malware-as-service. It lets attackers steal user credentials and other information through screenshots, keyboard logging, and clipboard capture. (F-Secure, 2021)
- There has been a rise of 15% in phishing incidents recorded in 2020 compared to 2019. (F5 Labs, 2020)
- 55% of phishing sites used target brand names and identities in their URLs. Moreover, 52% of malicious links indicate the brand name either in the domain name or the path. (F5 Labs, 2020)
- Password Hacking Statistics
- In April 2020, hackers sold 500,000 Zoom passwords, which ended up on dark web crime forums. The information that hackers obtained included names and Zoom URLs. (Forbes, 2020)
- 68% of small and medium businesses (SMBs) worldwide say that their employees’ passwords have been lost or stolen in the past year. Similarly, 68% of SMBs said that employees using weak passwords were one of their biggest pain points. (Ponemon Institute, 2019)
- Attacks involving compromised passwords cost SMBs an average of $384,598 for each attack. (Ponemon Institute, 2019)
- 55% of SMBs worldwide say that they do not have employee password usage policies. They were also unsure of such a policy. (Ponemon Institute, 2019)
- Less than half (48%) of SMBs worldwide require employees to use strong or unique passwords. Only 25% said that they can determine if employees are sharing passwords. (Ponemon Institute, 2019)
- Only 38% of SMBs worldwide prohibit employees from using the same password on internal systems. On the other hand, only 29% said that they require minimum password lengths. (Ponemon Institute, 2019)
- 52% of adults aged 16 to 50+ in the US reuse the same password. They use the same password for multiple but not all of their accounts. In contrast, 35% use a different password for all accounts. Meanwhile, 13% reuse the same password for all their accounts. (Google/Harris Poll, 2019)
- A survey revealed that 91% of people know that using the same password or variation puts them at risk. However, 66% always or mostly use the same password. (LastPass, 2020)
- Social Media Hacking Statistics
- During the first half of 2020, there was a 95% increase in executive/VIP-related threat activity for social media profiles. In total, there were 1.2 million incidents for more than 7,000 executives with highly public social media profiles. (ZeroFOX, 2021)
- On average, there were nearly three attempts per month at hijacking corporate social media accounts. Every year, takeover attempts occur around 30 times per institution. (ZeroFOX, 2021)
- Botnets can be used for launching disinformation campaigns using inauthentic social media, DDoS attacks, and other malicious acts. Bots can make up for 60% of overall web traffic. However, less than half of these can be declared as bots. These make tracking and blocking botnets challenging. (Council to Secure the Digital Economy, 2020)
- 53% of activity in fraud groups on social media involved discussions on carding or carding services. On the other hand, 16% discussed account takeover while 9% discussed wire transfers. (RSA Security, 2020)
- Most Common Hacking Attacks Statistics
- Hacking statistics from the FBI reveal that phishing is the top internet crime that victims complain about. Phishing attempts to imitate top brands to lure users into clicking on a malicious link. On the other hand, other reports point to various forms of malware used in data breaches like ransomware and infostealers.
- The top internet crime that people reported to the FBI IC3 was phishing. In 2020, the FBI IC3 received 241,342 phishing complaints. In second place was nonpayment or non-delivery with 108,869 complaints. Other top complaints involved extortion (76,741), personal data breaches (45,330), and identity theft (43,330). (FBI IC3, 2020)
- More than 80% of breaches that used hacking involved brute force or the use of lost or stolen credentials. (Verizon, 2020)
- External actors were responsible for 70% of data breaches. On the other hand, only 30% involved internal actors. More importantly, organized criminal groups were behind 55% of data breaches. (Verizon, 2020)
- 45% of data breaches featured hacking. Other tactics malicious actors utilized were errors from causal events (22%), social attacks (22%), malware (17%), and misuse by authorized users (8%). (Verizon, 2020)
- Only 18% of organizations were able to block at least one piece of ransomware through the year. (Verizon, 2020)
- Backdoor malware comprised 19% of malware samples in 2020 while 12% were keyloggers. (Verizon, 2020)
- 97% of data breaches in mobile devices involved error cases. (Verizon, 2020)
- In 2020, infostealers comprised 33% of malware threats. They are followed by Remote Access Trojans or RATs (32%) and Trojans (17%). (F-Secure, 2021)
- The most impersonated brand in phishing attacks is Outlook at 19%. In second place is Facebook at 17% while Office365 ranked third at 10%. (F-Secure, 2021)
- Ransomware attacks have increased by 800% during the pandemic. The switch to remote work has allowed hackers easy access to devices and networks. (MonsterCloud, 2020)
- Reasons for Hacking Statistics
- Hackers don’t hack just for fun. After all, it can be risky, especially in regions where cybersecurity laws are strict. For some, this risk is worth taking depending on their motivation. In most cases, it is for financial gain or corporate espionage. However, there are also those who simply hack to participate in bug bounty programs, to learn new techniques, or even to carry out political motives.
- 64% of data breaches in mobile devices were financially motivated. On the other hand, 5% were done for espionage purposes. (Verizon, 2020)
- 91% of data breaches in North American organizations were financially motivated. Motives of espionage consisted 5% of the breaches while 3% were motivated by grudges. (Verizon, 2020)
- Unlike black hat hackers, there are hackers who participate in bug bounty programs. In a survey, 78% of white hat hackers said that they want to use their hacking experience to look for or better compete for career opportunities. (HackerOne, 2020)
- By the end of 2019, white hat hackers earned a total of more than $82 million for valid vulnerability reports. (HackerOne, 2020)
- 68% of global white hat hackers said that their reason for doing hacking is to be challenged. On the other hand, 53% said they wanted to make money while 51% said that they wanted to learn tips and techniques. (HackerOne, 2020)
- Foreign governments, cybercriminals, and hacktivists have an interest in stealing data from government organizations. In 2020, data theft and leak attacks comprised 25% of attacks against governments. (IBM, 2021)
- What Motivates White Hat Hackers
- To learn tips and techniques
- Why Businesses Get Hacked
- The FBI IC3 received 19,369 Business Email Compromise (BEC)/ Email Account Compromise (EAC) complaints in 2020. These incidents led to adjusted losses of $1.8 billion. In addition, the FBI IC3 noted an increase in the number of BEC/EAC complaints. Hackers used stolen information from these breaches to put up a bank account for receiving lost or stolen BEC/EAC funds. Afterward, hackers transferred the funds to a cryptocurrency account. (FBI IC3, 2020)
- 32% of supply chain attacks targeted utility software. On the other hand, 24% targeted application software. Meanwhile, 12% targeted the code repository. Managed Service Provider and targeted software hosting both comprised a 5% share in the attacks. Other targets comprised 22% of the attacks. (F-Secure, 2021)
- One of the reasons businesses get hacked is to extort money from their users. For example, back in 2015, there was a data breach ofAshley Madisonusers. The company is a provider of an online dating service for married people. The breach involved 9.75GB in files and 32 million accounts. In 2020, breached data from 2015 was reused in sextortion emails. Compromised account owners were asked to pay 0.1188 in Bitcoin or $1,059 or risk public exposure of their sensitive account data. (Vade Secure, 2020)
- 60% of senior decision-makers in SMBs place cybersecurity at the bottom half of their priorities. (Keeper, 2019)
- Small businesses with 500 employees or less underestimate the likelihood of a cyberattack. Two out of the three senior SMB leaders believe that a cyberattack is unlikely. (Keeper, 2019)
- One out of four senior SMB leaders says that they don’t know where to start with cybersecurity measures. (Keeper, 2019)
- The Impact of Hacking Statistics
- Currently, the financial impact of internet crimes in the US amount to billions in losses. In the next five years, cybercrime losses will amount to trillions worldwide. Online payment fraud and hacking of cryptocurrency exchanges will likely be more prevalent, adding to the growing list of cybercrime trends.
- Total losses due to internet crimes in the US amounted to $4.2 billion in 2020. (FBI IC3, 2020)
- The cost of cybercrime is expected to cost the world $10.5 trillion annually by 2025. This amount is equivalent to losing $11.4 million per minute. In addition, the global costs of cybercrime are projected to grow by 15% year-on-year in the next five years. (Cybersecurity Ventures, 2020)
- There were 2,474 complaints related to ransomware made to the FBI IC3 in 2020. They accounted for $29.1 million in adjusted losses. (FBI IC3, 2020)
- In 2020, the state with the most number of internet crime victims was California. The Golden State reported 69,541 victims of internet crimes. Next to California is Florida with 53,793 victims and Texas with 38,640 victims. (FBI IC3, 2020)
- California was also the top state in terms of victim losses. The state recorded $621.5 million in losses due to internet crimes. New York came in second with $415.8 million in losses. Meanwhile, Texas came in at third place with $313.6 million in losses. (FBI IC3, 2020)
- Ecommerce losses due to online payment fraud are expected to reach over $25 billion annually by 2024. Forty-two percent of ecommerce payment fraud is expected to come from China. (Juniper Research, 2020)
- In 2019, the average value stolen through hacking cryptocurrency exchanges was $26 million. On the other hand, the median value that hackers stole was $16 million. (Chainanalysis, 2020)
- Hacking Prevention Statistics
- One way for individuals to avoid being victimized by hackers is to use strong passwords. However, data from leading reports show users do not follow best practices for passwords even though they are aware of the consequences. On the bright side, there is a growing awareness of using multi-factor authentication for personal and work accounts.
- Only 24% of US adults aged 16 to 50+ use a password manager. However, many people also say that they need a better way to track passwords. (Google/Harris Poll, 2019)
- Only 55% of US adults aged 16 to 50+ could correctly define the term “password manager.” Moreover, only 32% could correctly define “phishing,” “password manager,” and “two-step authentication”. (Google/Harris Poll, 2019)
- 53% of users around the globe have not changed their password in the last 12 months despite hearing about data breaches in news reports. (LastPass, 2020)
- 42% consider an easy-to-remember password as more important than a very secure password. (LastPass, 2020)
- In the same survey, 80% of people said that they will be concerned when their password is compromised. Yet, 48% said that they will not change their password if it’s not required. (LastPass, 2020)
- 42% of people think that their accounts aren’t worth a hacker’s time. (LastPass, 2020)
- 54% of people said they use multi-factor authentication for their personal accounts. On the other hand, 37% said they use it for work. (LastPass, 2020)
- 69% of people surveyed said that they would create strong passwords for the financial accounts. Other accounts mentioned where users would create strong passwords were email accounts (47%), medical records (31%), and work-related accounts (29%). (LastPass, 2020)
- The worst password to use is 123456. It has more than two million users, takes less than a second to crack, and has been exposed over 23 million times. (NordPass, 2020)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement